+/*
+ * Daniel Kouril <kouril@users.sourceforge.net>
+ *
+ * Source and Documentation can be found at:
+ * http://modauthkerb.sourceforge.net/
+ *
+ * Based on work by
+ * James E. Robinson, III <james@ncstate.net>
+ * Daniel Henninger <daniel@ncsu.edu>
+ * Ludek Sulak <xsulak@fi.muni.cz>
+ */
+
+/* ====================================================================
+ * The Apache Software License, Version 1.1
+ *
+ * Copyright (c) 2000-2003 The Apache Software Foundation. All rights
+ * reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ * notice, this list of conditions and the following disclaimer in
+ * the documentation and/or other materials provided with the
+ * distribution.
+ *
+ * 3. The end-user documentation included with the redistribution,
+ * if any, must include the following acknowledgment:
+ * "This product includes software developed by the
+ * Apache Software Foundation (http://www.apache.org/)."
+ * Alternately, this acknowledgment may appear in the software itself,
+ * if and wherever such third-party acknowledgments normally appear.
+ *
+ * 4. The names "Apache" and "Apache Software Foundation" must
+ * not be used to endorse or promote products derived from this
+ * software without prior written permission. For written
+ * permission, please contact apache@apache.org.
+ *
+ * 5. Products derived from this software may not be called "Apache",
+ * nor may "Apache" appear in their name, without prior written
+ * permission of the Apache Software Foundation.
+ *
+ * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESSED OR IMPLIED
+ * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL THE APACHE SOFTWARE FOUNDATION OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF
+ * USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+ * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
+ * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This software consists of voluntary contributions made by many
+ * individuals on behalf of the Apache Software Foundation. For more
+ * information on the Apache Software Foundation, please see
+ * <http://www.apache.org/>.
+ *
+ * Portions of this software are based upon public domain software
+ * originally written at the National Center for Supercomputing Applications,
+ * University of Illinois, Urbana-Champaign.
+ */
+
#ident "$Id$"
+#define MODAUTHKERB_VERSION "5.0-rc2"
+
#ifndef APXS1
#include "ap_compat.h"
#include "apr_strings.h"
#ifdef KRB5
#include <krb5.h>
-#include <gssapi.h>
-#ifndef HEIMDAL
-#include <gssapi_generic.h>
-#define GSS_C_NT_USER_NAME gss_nt_user_name
-#define GSS_C_NT_HOSTBASED_SERVICE gss_nt_service_name
-#define krb5_get_err_text(context,code) error_message(code)
+#ifdef HEIMDAL
+# include <gssapi.h>
+#else
+# include <gssapi/gssapi.h>
+# include <gssapi/gssapi_generic.h>
+# define GSS_C_NT_USER_NAME gss_nt_user_name
+# define GSS_C_NT_HOSTBASED_SERVICE gss_nt_service_name
+# define krb5_get_err_text(context,code) error_message(code)
#endif
#endif /* KRB5 */
#ifdef KRB4
+/*Prevent warning about closesocket redefinition (Apache's ap_config.h and
+ * MIT Kerberos' port-sockets.h both define it as close) */
+#ifdef closesocket
+# undef closesocket
+#endif
#include <krb.h>
+#include <netdb.h> /* gethostbyname() */
#endif /* KRB4 */
#ifdef APXS1
***************************************************************************/
typedef struct {
char *krb_auth_realms;
- char *krb_force_instance;
int krb_save_credentials;
- char *service_name;
#ifdef KRB5
char *krb_5_keytab;
int krb_method_gssapi;
command("KrbSaveCredentials", ap_set_flag_slot, krb_save_credentials,
FLAG, "Save and store credentials/tickets retrieved during auth."),
- command("KrbServiceName", ap_set_string_slot, service_name,
- TAKE1, "Kerberos service name to be used by apache."),
-
#ifdef KRB5
command("Krb5Keytab", ap_set_file_slot, krb_5_keytab,
TAKE1, "Location of Kerberos V5 keytab file."),
va_start(ap, fmt);
vsnprintf(errstr, sizeof(errstr), fmt, ap);
va_end(ap);
-
+
+ /* these functions also print out current errno (if not zero), resulting in
+ * lines of the format:
+ * (errno)strerror(errno): errstr
+ * This behaviour can be avoided by using APLOG_NOERRNO */
#ifdef APXS1
ap_log_rerror(file, line, level, r, "%s", errstr);
#else
/***************************************************************************
Username/Password Validation for Krb4
***************************************************************************/
-int kerb4_password_validate(request_rec *r, const char *user, const char *pass)
+static int
+verify_krb4_user(request_rec *r, char *name, char *instance, char *realm,
+ char *password, char *linstance, char *srvtab)
+{
+ int ret;
+ char *phost;
+ unsigned long addr;
+ struct hostent *hp;
+ const char *hostname;
+ KTEXT_ST ticket;
+ AUTH_DAT authdata;
+ char lrealm[REALM_SZ];
+
+ ret = krb_get_pw_in_tkt(name, instance, realm, "krbtgt", realm,
+ DEFAULT_TKT_LIFE, password);
+ if (ret) {
+ log_rerror(APLOG_MARK, APLOG_ERR, 0, r,
+ "Cannot get krb4 ticket: krb_get_pw_in_tkt() failed: %s",
+ krb_get_err_text(ret));
+ return ret;
+ }
+
+ hostname = ap_get_server_name(r);
+
+ hp = gethostbyname(hostname);
+ if (hp == NULL) {
+ dest_tkt();
+ log_rerror(APLOG_MARK, APLOG_ERR, 0, r,
+ "Cannot verify krb4 ticket: gethostbyname() failed: %s",
+ hstrerror(h_errno));
+ return h_errno;
+ }
+ memcpy(&addr, hp->h_addr, sizeof(addr));
+
+ phost = krb_get_phost((char *)hostname);
+
+ krb_get_lrealm(lrealm, 1);
+
+ ret = krb_mk_req(&ticket, linstance, phost, lrealm, 0);
+ if (ret) {
+ log_rerror(APLOG_MARK, APLOG_ERR, 0, r,
+ "Cannot verify krb4 ticket: krb_mk_req() failed: %s",
+ krb_get_err_text(ret));
+ dest_tkt();
+ return ret;
+ }
+
+ ret = krb_rd_req(&ticket, linstance, phost, addr, &authdata, srvtab);
+ if (ret) {
+ log_rerror(APLOG_MARK, APLOG_ERR, 0, r,
+ "Cannot verify krb4 ticket: krb_rd_req() failed: %s",
+ krb_get_err_text(ret));
+ dest_tkt();
+ }
+
+ return ret;
+}
+
+static int
+krb4_cache_cleanup(void *data)
{
- kerb_auth_config *conf =
- (kerb_auth_config *)ap_get_module_config(r->per_dir_config,
- &auth_kerb_module);
- int ret;
- int lifetime = DEFAULT_TKT_LIFE;
- char *c, *tfname;
- char *username = NULL;
- char *instance = NULL;
- char *realm = NULL;
-
- username = (char *)ap_pstrdup(r->pool, user);
- if (!username) {
- return 0;
- }
-
- instance = strchr(username, '.');
- if (instance) {
- *instance++ = '\0';
- }
- else {
- instance = "";
- }
-
- realm = strchr(username, '@');
- if (realm) {
- *realm++ = '\0';
- }
- else {
- realm = "";
- }
-
- if (conf->krb_lifetime) {
- lifetime = atoi(conf->krb_lifetime);
- }
-
- if (conf->krb_force_instance) {
- instance = conf->krb_force_instance;
- }
-
- if (conf->krb_save_credentials) {
- tfname = (char *)malloc(sizeof(char) * MAX_STRING_LEN);
- sprintf(tfname, "/tmp/k5cc_ap_%s", MK_USER);
-
- if (!strcmp(instance, "")) {
- tfname = strcat(tfname, ".");
- tfname = strcat(tfname, instance);
- }
-
- if (!strcmp(realm, "")) {
- tfname = strcat(tfname, ".");
- tfname = strcat(tfname, realm);
- }
-
- for (c = tfname + strlen("/tmp") + 1; *c; c++) {
- if (*c == '/')
- *c = '.';
- }
-
- krb_set_tkt_string(tfname);
- }
-
- if (!strcmp(realm, "")) {
- realm = (char *)malloc(sizeof(char) * (REALM_SZ + 1));
- ret = krb_get_lrealm(realm, 1);
- if (ret != KSUCCESS)
- return 0;
- }
-
- ret = krb_get_pw_in_tkt((char *)user, instance, realm, "krbtgt", realm,
- lifetime, (char *)pass);
- switch (ret) {
- case INTK_OK:
- case INTK_W_NOTALL:
- return 1;
- break;
-
- default:
- return 0;
- break;
- }
+ char *tkt_file = (char *) data;
+
+ krb_set_tkt_string(tkt_file);
+ dest_tkt();
+ return OK;
+}
+
+static int
+authenticate_user_krb4pwd(request_rec *r,
+ kerb_auth_config *conf,
+ const char *auth_line)
+{
+ int ret;
+ const char *sent_pw;
+ const char *sent_name;
+ char *sent_instance;
+ char tkt_file[32];
+ char *tkt_file_p = NULL;
+ int fd;
+ const char *realms;
+ const char *realm;
+ char *user;
+ char lrealm[REALM_SZ];
+
+ sent_pw = ap_pbase64decode(r->pool, auth_line);
+ sent_name = ap_getword (r->pool, &sent_pw, ':');
+
+ /* do not allow user to override realm setting of server */
+ if (strchr(sent_name, '@')) {
+ log_rerror(APLOG_MARK, APLOG_ERR, 0, r,
+ "specifying realm in user name is prohibited");
+ return HTTP_UNAUTHORIZED;
+ }
+
+ sent_instance = strchr(sent_name, '.');
+ if (sent_instance)
+ *sent_instance++ = '\0';
+
+ snprintf(tkt_file, sizeof(tkt_file), "/tmp/apache_tkt_XXXXXX");
+ fd = mkstemp(tkt_file);
+ if (fd < 0) {
+ log_rerror(APLOG_MARK, APLOG_ERR, 0, r,
+ "Cannot create krb4 ccache: mkstemp() failed: %s",
+ strerror(errno));
+ return HTTP_INTERNAL_SERVER_ERROR;
+ }
+
+ tkt_file_p = ap_pstrdup(r->pool, tkt_file);
+ ap_register_cleanup(r->pool, tkt_file_p,
+ krb4_cache_cleanup, ap_null_cleanup);
+
+ krb_set_tkt_string(tkt_file);
+
+ realms = conf->krb_auth_realms;
+ do {
+ memset(lrealm, 0, sizeof(lrealm));
+ realm = NULL;
+ if (realms)
+ realm = ap_getword_white(r->pool, &realms);
+
+ if (realm == NULL) {
+ ret = krb_get_lrealm(lrealm, 1);
+ realm = lrealm;
+ }
+ if (realm == NULL || *realm == '\0')
+ break;
+
+ ret = verify_krb4_user(r, (char *)sent_name,
+ (sent_instance) ? sent_instance : "",
+ (char *)realm, (char *)sent_pw, "khttp",
+ conf->krb_4_srvtab);
+ if (ret == 0)
+ break;
+ } while (realms && *realms);
+
+ if (ret) {
+ log_rerror(APLOG_MARK, APLOG_ERR, 0, r, "Verifying krb4 password failed");
+ ret = HTTP_UNAUTHORIZED;
+ goto end;
+ }
+
+ user = ap_pstrdup(r->pool, sent_name);
+ if (sent_instance)
+ user = ap_pstrcat(r->pool, user, ".", sent_instance, NULL);
+ user = ap_pstrcat(r->pool, user, "@", realm, NULL);
+
+ MK_USER = user;
+ MK_AUTH_TYPE = "Basic";
+ ap_table_setn(r->subprocess_env, "KRBTKFILE", tkt_file_p);
+
+ if (!conf->krb_save_credentials)
+ krb4_cache_cleanup(tkt_file);
+
+end:
+ if (ret)
+ krb4_cache_cleanup(tkt_file);
+ close(fd);
+ tf_close();
+
+ return ret;
}
#endif /* KRB4 */
/***************************************************************************
Username/Password Validation for Krb5
***************************************************************************/
-#ifndef HEIMDAL
-krb5_error_code
-krb5_verify_user(krb5_context context, krb5_principal principal,
- krb5_ccache ccache, const char *password, krb5_boolean secure,
- const char *service)
+/* Inspired by krb5_verify_user from Heimdal */
+static krb5_error_code
+verify_krb5_user(request_rec *r, krb5_context context, krb5_principal principal,
+ krb5_ccache ccache, const char *password, const char *service,
+ krb5_keytab keytab)
{
krb5_creds creds;
krb5_principal server = NULL;
if (ret)
return ret;
- ret = krb5_sname_to_principal(context, NULL, service,
+ ret = krb5_sname_to_principal(context, ap_get_server_name(r), service,
KRB5_NT_SRV_HST, &server);
if (ret)
goto end;
krb5_verify_init_creds_opt_init(&opt);
- krb5_verify_init_creds_opt_set_ap_req_nofail(&opt, secure);
+ krb5_verify_init_creds_opt_set_ap_req_nofail(&opt, 1);
- ret = krb5_verify_init_creds(context, &creds, server, NULL, NULL, &opt);
+ ret = krb5_verify_init_creds(context, &creds, server, keytab, NULL, &opt);
if (ret)
goto end;
krb5_free_principal(context, server);
return ret;
}
-#endif
-
static int
krb5_cache_cleanup(void *data)
krb5_ccache tmp_ccache = NULL;
#ifdef HEIMDAL
+ /* new MIT krb5-1.3.x also supports this call */
problem = krb5_cc_gen_new(kcontext, &krb5_fcc_ops, &tmp_ccache);
#else
problem = krb5_fcc_generate_new(kcontext, &tmp_ccache);
const char *sent_pw = NULL;
const char *sent_name = NULL;
const char *realms = NULL;
- const char *service_name = NULL;
krb5_context kcontext = NULL;
krb5_error_code code;
krb5_principal client = NULL;
krb5_ccache ccache = NULL;
+ krb5_keytab keytab = NULL;
int ret;
char *name = NULL;
}
if (conf->krb_5_keytab)
- setenv("KRB5_KTNAME", conf->krb_5_keytab, 1);
- /* kcontext->default_keytab = conf->krb_5_keytab; */
-
- if (conf->service_name) {
- char *p;
- service_name = ap_pstrdup(r->pool, conf->service_name);
- if ((p=strchr(service_name, '/')))
- *p = '\0';
- } else
- service_name = "khttp";
+ krb5_kt_resolve(kcontext, conf->krb_5_keytab, &keytab);
realms = conf->krb_auth_realms;
do {
if (code)
continue;
- code = krb5_verify_user(kcontext, client, ccache, sent_pw, 1,
- service_name);
+ code = verify_krb5_user(r, kcontext, client, ccache, sent_pw, "khttp",
+ keytab);
if (code == 0)
break;
krb5_free_principal(kcontext, client);
if (ccache)
krb5_cc_destroy(kcontext, ccache);
+ if (keytab)
+ krb5_kt_close(kcontext, keytab);
krb5_free_context(kcontext);
return ret;
gss_buffer_desc input_token = GSS_C_EMPTY_BUFFER;
OM_uint32 major_status, minor_status, minor_status2;
gss_name_t server_name = GSS_C_NO_NAME;
+ char buf[1024];
+
+ snprintf(buf, sizeof(buf), "%s/%s", "khttp", ap_get_server_name(r));
+
+ input_token.value = buf;
+ input_token.length = strlen(buf) + 1;
- if (conf->service_name) {
- input_token.value = conf->service_name;
- input_token.length = strlen(conf->service_name) + 1;
- }
- else {
- input_token.value = "khttp";
- input_token.length = 6;
- }
major_status = gss_import_name(&minor_status, &input_token,
- (conf->service_name) ?
- GSS_C_NT_USER_NAME : GSS_C_NT_HOSTBASED_SERVICE,
+ GSS_C_NT_USER_NAME,
&server_name);
if (GSS_ERROR(major_status)) {
log_rerror(APLOG_MARK, APLOG_ERR, 0, r,
ap_register_cleanup(r->connection->pool, gss_connection, cleanup_gss_connection, ap_null_cleanup);
}
- if (conf->krb_5_keytab)
- setenv("KRB5_KTNAME", conf->krb_5_keytab, 1);
+ if (conf->krb_5_keytab) {
+ char *ktname;
+ /* we don't use the ap_* calls here, since the string passed to putenv()
+ * will become part of the enviroment and shouldn't be free()ed by apache
+ */
+ ktname = malloc(strlen("KRB5_KTNAME=") + strlen(conf->krb_5_keytab) + 1);
+ if (ktname == NULL) {
+ log_rerror(APLOG_MARK, APLOG_ERR, 0, r, "malloc() failed: not enough memory");
+ ret = HTTP_INTERNAL_SERVER_ERROR;
+ goto end;
+ }
+ sprintf(ktname, "KRB5_KTNAME=%s", conf->krb_5_keytab);
+ putenv(ktname);
+ }
if (gss_connection->server_creds == GSS_C_NO_CREDENTIAL) {
ret = get_gss_creds(r, conf, &gss_connection->server_creds);
}
input_token.length = ap_base64decode(input_token.value, auth_param);
- major_status = gss_accept_sec_context(&minor_status,
+#if 0
+ major_status = gss_accept_sec_context(
+#else
+ major_status = gss_accept_sec_context_spnego(
+#endif
+ &minor_status,
&gss_connection->context,
gss_connection->server_creds,
&input_token,
ap_base64encode(token, output_token.value, output_token.length);
token[len] = '\0';
ap_table_set(r->err_headers_out, "WWW-Authenticate",
- ap_pstrcat(r->pool, "GSS-Negotiate ", token, NULL));
+ ap_pstrcat(r->pool, "Negotiate ", token, NULL));
gss_release_buffer(&minor_status2, &output_token);
}
gss_release_buffer(&minor_status, &output_token);
-#if 0
- /* If the user comes from a realm specified by configuration don't include
- its realm name in the username so that the authorization routine could
- work for both Password-based and Ticket-based authentication. It's
- administrators responsibility to include only such realm that have
- unified principal instances, i.e. if the same principal name occures in
- multiple realms, it must be always assigned to a single user.
- */
- p = strchr(r->connection->user, '@');
- if (p != NULL) {
- const char *realms = conf->gss_krb5_realms;
-
- while (realms && *realms) {
- if (strcmp(p+1, ap_getword_white(r->pool, &realms)) == 0) {
- *p = '\0';
- break;
- }
- }
- }
-#endif
-
ret = OK;
end:
/* XXX should the WWW-Authenticate header be cleared first? */
#ifdef KRB5
if (use_krb5 && conf->krb_method_gssapi)
- ap_table_add(r->err_headers_out, "WWW-Authenticate", "GSS-Negotiate ");
+ ap_table_add(r->err_headers_out, "WWW-Authenticate", "Negotiate");
if (use_krb5 && conf->krb_method_k5pass) {
ap_table_add(r->err_headers_out, "WWW-Authenticate",
ap_pstrcat(r->pool, "Basic realm=\"", auth_name, "\"", NULL));
#ifdef KRB5
if (use_krb5 && conf->krb_method_gssapi &&
- strcasecmp(auth_type, "GSS-Negotiate") == 0) {
+ strcasecmp(auth_type, "Negotiate") == 0) {
ret = authenticate_user_gss(r, conf, auth_line);
} else if (use_krb5 && conf->krb_method_k5pass &&
strcasecmp(auth_type, "Basic") == 0) {
NULL /* [ 1] post read_request handling */
};
#else
+static int
+kerb_init_handler(apr_pool_t *p, apr_pool_t *plog,
+ apr_pool_t *ptemp, server_rec *s)
+{
+ ap_add_version_component(p, "mod_auth_kerb/" MODAUTHKERB_VERSION);
+ return OK;
+}
+
void kerb_register_hooks(apr_pool_t *p)
{
+ ap_hook_post_config(kerb_init_handler, NULL, NULL, APR_HOOK_MIDDLE);
ap_hook_check_user_id(kerb_authenticate_user, NULL, NULL, APR_HOOK_MIDDLE);
}
projects / mod_auth_kerb.git / blobdiff